What Article 4 of the EU AI Act asks of your team
Your employees are already using AI at work — drafting emails, summarising documents, answering customers. The EU AI Act assumes exactly that, and Article 4 makes it your obligation to ensure they can do it competently. Not someday: the article has been in application since 2 February 2025.
What Article 4 actually requires
Article 4 requires providers and deployers of AI systems to ensure, to their best extent, “a sufficient level of AI literacy” among staff and anyone operating AI on their behalf — taking into account their technical knowledge, experience, education, and the context the AI is used in. If your organization uses AI systems in the EU, you are a deployer, and this applies to you.
Three things stand out once you read it closely:
- It covers users, not just builders. You don’t need to ship an AI product to be in scope. A support team pasting customer questions into a chatbot is “operating an AI system”.
- It is context-dependent by design. The regulation doesn’t prescribe a certificate or a fixed curriculum. “Sufficient” is measured against what your people actually do with AI — which tools, which data, which decisions.
- “To their best extent” implies you can show your working. An obligation you can’t evidence is an obligation you can’t demonstrate you met.
The full text is short and worth reading: Article 4, Regulation (EU) 2024/1689.
“Sufficient” depends on the role
The same tool creates different risks in different hands. The AI literacy your HR lead needs — where AI touches hiring and performance decisions — is not the AI literacy your support team needs, and neither matches what your engineers need when they integrate a model into your product.
That’s why a single generic AI awareness session tends to fail the “sufficient” test in spirit, even if it ticks a box. The decisions people face are role-specific:
- Can support send an AI-drafted answer straight to a customer?
- Can HR use AI to rank job candidates?
- What customer data can anyone, in any role, paste into a chatbot?
Literacy that changes behaviour teaches the rule, then practises the decision each role actually makes — grounded in your own AI policy and your own tools, not a vendor’s abstractions.
Literacy you can’t show is literacy you can’t prove
When your board, an auditor, or a regulator asks how you meet Article 4, “we ran a workshop in spring” is a weak answer. A strong answer names who has been trained, on what, to what level, and shows the record behind it — per person, per role, per topic.
That means the evidence has to be produced by the learning itself: which scenarios each person worked through, how they responded, and what they have demonstrably mastered — not an attendance sheet.
Where to start
- Inventory your AI reality. Which tools are in use (approved or not), what data flows into them, and which roles rely on them.
- Set the baseline for everyone. Safe use, data handling, hallucinations, confidentiality — the shared floor every employee needs.
- Add specialist roles in phases. Managers, HR, support, product, engineering — each gets the decisions that belong to them. Keep records from day one, so the evidence accumulates as people learn.
This is precisely the shape of our AI Act readiness program: your policy and tools turned into role-based learning, a personal tutor for every person, and readiness evidence you can export when someone asks. If you’re mapping your own rollout, book a walkthrough and bring your AI policy.
Ulern builds readiness and evidence. This post explains the obligation in plain terms — it is not legal advice.